crossdomain

I'm looking to create an api for my site where another site can consume and display certain data from my site. Ideally I would like to limit access to only those domains that have applied for an API key. I also am think that the JSON server makes the most sense. I've tried to go through the documentation, but there are stil a number of think that are not clear.

I'm using Flex to build cross-domain widgets that can be embedded on any domain. These widgets consume data via Services and AMFPHP. Unfortunately, I've been notified that my site is now vulnerable to attacks because I have a liberal crossdomain.xml policy file that allows connections from any domain.